d7dfd3d310c5139ded39804866563572b64969bf71ae556b59edcae9680efe30

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2022 21:51

Target

Discord Toolz/Utils/API's/bin/TOKEN STEALER CREATOR.csproj
Size

4KB
MD5

9b49bc17c0d53f6266d029bfc2688ec7
SHA1

f9f6a4af73933e8a0f37cd47210a1c63279d330e
SHA256

198273da6848a526bd90796ef1d68256710dd1497f545b087b1687fd74eaf6ed
SHA512

5aa3409635eab67cf81885a4b7ed2a36478b6fbbaee29b2f0336d9d89afa92d0e8dfca39dd444dfe7fdf83ec5308305a37d8f22448974348a69c912084ee3664
SSDEEP

96:7YWnpu58macaxEa460E5vbaJNrNBCHMOdsHVSLYFrs:7DmAWJNHpQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4248 OpenWith.exe

pid	process
4248	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Discord Toolz\Utils\API's\bin\TOKEN STEALER CREATOR.csproj"
1⤵
- Modifies registry class
PID:5092

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact